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The MAILING DATE of this communication appears on the cover sheet with the correspondence address -- 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1.136(a). In no event, hovy^ever, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 1 33). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )S Responsive to connmunication(s) filed on 16 March 2007 . 
2a)n This action is FINAL, 2b)^ This action is non-final. 

3) 0 Since this application is in condition for allowance except for fornnal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) ^ Claim(s) 1-15 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) 0 Claim(s) is/are allowed. 

6) ^ .Claim(s) 1-15 is/are rejected. 
?)□ Claim(s) is/are objected to. 

8) n Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) n The specification is objected to by the Examiner. 

10)^ The drawing(s) filed on 24 July 2001 is/are: a)S accepted or b)n objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 

Replacement drawing sheet(s) Including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 1 )□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-1 52. 

Priority under 35 U.S.C. § 119 

12)n Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)n All b)n Some * c)^ None of: 

1 .□ Certified copies of the priority documents have been received. 

2. n Certified copies of the priority documents have been received in Application No. . 

3. n Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

1. Claims 1-15 have been examined. 



2. In view of the Appeal Brief filed on 3/16/07, PROSECUTION IS HEREBY 
REOPENED. New grounds of rejection are set forth below. 

To avoid abandonment of the application, appellant must exercise one of the following 
two options: 

(1) file a reply under 37 CFR 1.111 (if this Office action is non-final) or a reply under 37 
CFR 1.1 13 (if this Office action is final); or, 

(2) initiate a new appeal by filing a notice of appeal under 37 CFR 41.31 followed by an 
appeal brief under 37 CFR 41.37. The previously paid notice of appeal fee and appeal brief fee 
can be applied to the new appeal. If, however, the appeal fees set forth in 37 CFR 41 .20 have 
been increased since they were previously paid, then appellant must pay the difference between 
the increased fees and the amount previously paid. 

A Supervisory Patent Examiner (SPE) has approved of reopening prosecution by signing 



below: 




GILBERTO BARRON jt 
SUPERVISORY PATENT EXAMINER 
TECHNOLOGY CENTER 2100 

Double Patenting 

3. The nonstatutory double patenting rejection is based on a judicially created doctrine 
grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or 
improper timewise extension of the "right to exclude" granted by a patent and to prevent possible 
harassment by multiple assignees. A nonstatutory obviousness-type double patenting rejection 
is appropriate where the conflicting claims are not identical, but at least one examined 
application claim is not patentably distinct from the reference claim(s) because the examined 
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application claim is either anticipated by, or would have been obvious over, the reference 
claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re 
Goodman, 1 1 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re LongU 759 F.2d 887, 225 
USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re 
Vogeh 422 F.2d 438, 164 USPQ 619 (CCPA 1970); and In re Thorington, 418 F.2d 528, 163 
USPQ 644 (CCPA 1969). 

A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may 
be used to overcome an actual or provisional rejection based on a nonstatutory double patenting 
ground provided the conflicting application or patent either is shown to be commonly owned 
with this application, or claims an invention made as a result of activities undertaken within the 
scope of a joint research agreement. 

Effective January 1, 1994, a registered attorney or agent of record may sign a terminal 
disclaimer. A terminal disclaimer signed by the assignee must fully comply with 37 CFR 
3.73(b). 

4. Claims 1,3,5,8, and 1 0 are provisionally rejected on the ground of nonstatutory double 
patenting over claim 1 of copending Application No. 10/024,202. This is a provisional double 
patenting rejection since the conflicting claims have not yet been patented. 

The subject matter claimed in the instant application is fully disclosed in the referenced 
copending application and would be covered by any patent granted on that copending application 
since the referenced copending application and the instant application are claiming common 
subject matter, as follows: co-pending applications and present application disclose a scanning 
system, an anti-virus server, and a switch for performing the same virus protection procedures. 
The instant claims are broader in scope to the claims for co-pending application and are therefore 



obvious from them. 
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Claim Rejections - 35 USC § 112 

5. The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 

6. Claim 6 is rejected under 35 U.S.C. 1 12, second paragraph, as being indefinite for failing 
to particularly point out and distinctly claim the subject matter which applicant regards as the 
invention. 

7. Claim 6 recites the limitation "the decoy servers" in line 3. There is insufficient 
antecedent basis for this limitation in the claim. 

Claim Rejections - 35 USC § 103 

8. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 

obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

9. Claims 1, 3, 5, 6, 8 and 10-15 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Hypponen et al. U.S. Pub. No. 20030191957 (hereinafter Hypponen) in view of Yanovsky 
U.S. Pat. No. 7010807 (hereinafter Yanovsky). 

10. As per claim 1, 5, 8, and 10„ Hypponen discloses a network security system to be 
deployed between a plurality of network (intranet) belonging to respective organizations and an 
internet backbone, comprising: a scanning system coupled to the network (intranet) for scanning 
incoming electronic mail for malicious code (Hypponen: [001 1]; virus scanning server), and a 
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switch coupled between the internet backbone and the scanning system (Hypponen: figure 1 and 
[0012] and [0013]: transit nodes 4a); said switch configured for: directing incoming electronic 
mail from the internet backbone to the scanning system (Hypponen: [0008]-[0009]: directing the 
data from transit node to scarming server). Hypponen does not explicitly disclose an anti-virus 
server coupled to the network (intranet) for downloading anti-virus code to clients coupled to the 
network (intranet). However, Yanovsky discloses an internet access module for updating anti- 
virus protection on network devices by periodically updating network devices (Yanovsky: 
column 1 line 66 - column 2 line 1 1). It would have been obvious to one having ordinary skill in 
the art to utilize the internet access module/anti-virus server and the scanning server as an anti- 
virus system to be coupled to a transit node/switch because providing virus scanning and virus 
code update are well known features of anti-virus systems and both prior art discloses protection 
of local area network/intranets. Furthermore, although Hypponen does not explicitly discloses 
the switch is coupled to a plurality of intranets, it would have been obvious to one having 
ordinary skill in the art to apply the intranet anti-virus system to plurality of intranets to reduce 
the cost of implementing a separate system for each intranet. Therefore, it would have been 
obvious to one having ordinary skill in the art at the time of applicant's invention to combine the 
teachings of Yanovsky within the system of Hypponen because it ensure anti-virus software 
residing on network devices are up-to-date (Yanovsky: column 2 lines 10-11). 

11. As per claim 3, Hypponen discloses a network security system to be deployed between a 
plurality of network (intranet) belonging to respective organizations and an internet backbone, 
comprising: a scanning system coupled to the network (intranet) for scanning incoming 
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electronic mail for malicious code (Hypponen: [001 1]: virus scanning server); a mail proxy 
server for determining whether the incoming electronic mail is to be scanned for malicious code 
and directing the incoming electronic mail to the scanning system when the incoming electronic 
mail is determined to be scanned for malicious code (Hypponen: [0032] and [0036]: the data is 
routed from Internet via firewall 4a to mail server); and a switch coupled between the internet 
backbone, and the scanning system (Hypponen: figure 1 and [0012] and [0013]: transit nodes); 
said switch configured for: directing incoming electronic mail from the internet backbone to the 
mail proxy server (Hypponen: [0032]: pass data from firewall to mail server). Hypponen does 
not explicitly disclose an anti-virus server coupled to the network (intranet) for downloading 
anti-virus code to clients coupled to the network (intranet). However, Yanovsky discloses an 
internet access module for updating anti-virus protection on network devices by periodically 
updating network devices (Yanovsky: column 1 line 66 - column 2 line 1 1). It would have been 
obvious to one having ordinary skill in the art to utilize the internet access module/anti-virus 
server and the scanning server as an anti- virus system to be coupled to a transit node/switch 
because providing virus scanning and virus code update are well known features of anti-virus 
systems and both prior art discloses protection of local area network/intranets. Furthermore, 
although Hypponen does not explicitly discloses the switch is coupled to a plurality of intranets, 
it would have been obvious to one having ordinary skill in the art to apply the intranet anti-virus 
system to plurality of intranets to reduce the cost of implementing a separate system for each 
intranet. Therefore, it would have been obvious to one having ordinary skill in the art at the time 
of applicant's invention to combine the teachings of Yanovsky within the system of Hypponen 
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because it ensure anti-virus software residing on network devices are up-to-date (Yanovsky: 
column 2 lines 10-11). 

12. As per claim 6 and 11, Hypponen as modified discloses the network security system 
according to claims 5 and 10 respectively. Hypponen as modified further discloses load- 
balancing among the scanning systems and proxy servers (Hypponen: [0043]). 

13. As per claim 12-15, Hypponen as modified discloses the system of claims 1, 3, 8, 10 
respectively. Hypponen as modified further disclose a hub in communication with the scanning 
system and the intranets, wherein the scanning system is further configured for sanitizing at least 
some of the incoming electronic mail addressed to recipients on the intranets and directing the 
sanitized incoming electronic mail to the recipients via the hub (Hypponen: [0038] and [0042]: 
disinfect the files) 

14. Claims 2, 4, 7, and 9 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Hypponen in view of Yanovsky and further in view of Network Associates, Inc. "Network 
Associates Ships Cybercop Sting- Industry's first 'Decoy' Server Silently Traces and Tracks 
Hacker Activity" (hereinafter NAI). 

15. As per claim 2, 4, 7, and 9, Hypponen as modified discloses the system of claims 1, 3, 5, 
and 8 respectively. Hypponen as modified does not explicitly disclose a decoy server coupled to 
the intranets for masquerading as a legitimate server and logging activity on communications 
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received via the internet backbone; wherein the switch is further coupled to the decoy server and 
is further configured for redirecting suspicious traffic from the internet backbone to the decoy 
server. However, NAI discloses decoy server is used to trace and track hackers and reporting all 
intrusive activities (NAI: page 1). It would have been obvious one having ordinary skill in the art 
to include decoy server into the anti-virus system because Hypponen and NAI both are applied 
within a network anti-virus environment. Therefore, it would have been obvious to one having 
ordinary skill in the art at the time of applicant's invention to combine the teachings of NAI 
within the combination of Hypponen- Yanovsky because it provides additionally security 
measure to web clients. 

Response to Arguments 
16. Applicant's arguments with respect to claims 1-15 have been considered but are moot in 
view of the new ground(s) of rejection. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Shin-Hon Chen whose telephone number is (571) 272-3789. The 
examiner can normally be reached on Monday through Friday 8:30am to 5:30pm. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on (571) 272-3795. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



Shin-Hon Chen 
Examiner 
Art Unit 2131 




6ILBERT0 BARRON J/L 
SUPERVISORY PATENT EXAMINER 
TECHNOLOGY CENTER 2100 



